URL Injection Help

I have a client that has recently been hacked. Several sitemaps have been created and have URLs linking to porn sites. Since there wasn’t a backup to a previous version of the site, I’ve gone ahead and deleted the PHP files that were added by the hacker and edited the core WP files that have been modified with malicious code. There were several sites that looked like this that Google has flagged:

https://example.com/sitemap_e67b02.html

My question is, how to I delete this sitemap from the website? Do I have to do it from the database? All the regular database files are there and there isn’t any added tables. So which table would have these 7 sites listed on them?

Maybe when I deleted the php files and edited out the malicious code, that removed these pages. I just want to make sure that I’ve done everything I can before I submit the site for review to the Google Search Console. All help is appreciated!